From 1ea2c77066523a20c4c239a5f25df1179899c224 Mon Sep 17 00:00:00 2001
From: Ed Ball <ed.ball@logos.com>
Date: Sat, 15 Aug 2026 15:58:44 -0700
Subject: [PATCH] Use trusted NuGet publishing in CI

---
 .github/workflows/ci.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b3458c..44825ea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,11 +65,19 @@ jobs:
     runs-on: windows-latest
     needs: build
     if: github.repository_owner == 'ejball' && github.ref == 'refs/heads/master'
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - name: Check out code
       uses: actions/checkout@v6
     - name: Install .NET
       uses: actions/setup-dotnet@v5
+    - name: NuGet login
+      uses: NuGet/login@v1
+      id: nuget-login
+      with:
+        user: ejball
     - name: Download packages
       uses: actions/download-artifact@v8
       with:
@@ -78,5 +86,5 @@ jobs:
     - name: Publish
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
       run: ./build.ps1 publish --skip package --trigger publish-nuget-output
\ No newline at end of file